{ "ml": { "l": 0, "v": "6", "fs": [ { "l": 0, "id": 0, "prob": 1.0 } ], "prob": 1.0, "models": [ { "m": "az", "prob": 0.93138736, "class": 0 }, { "m": "az/documents", "prob": 0.99323046, "class": 0 }, { "m": "az/xlsx", "prob": 1.0, "class": 2 } ], "version": "v17.17", "analyzed_at": "2026-06-04T03:25:19Z" }, "path": "902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191.xlsm", "raw": { "v": "6", "fs": [ { "f": "Md(Ag)", "x": 1, "ff": { "m": { "file": { "size": 260448.0, "entropy": 7.99, "size_bytes": 260448.0 }, "binary": { "overall_entropy": 7.99 }, "office": { "macro_count": 1.0, "ooxml.entry_count": 17.0, "ooxml.max_entry_size": 238205.0, "ooxml.image_part_count": 2.0, "is_macro_enabled_extension": 1.0, "ooxml.declares_vba_project": 1.0, "ooxml.declares_macro_enabled": 1.0 }, "archive": { "file_count": 17.0, "member_count": 17.0, "script_count": 0.0, "zip_bomb_ratio": 7.14, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 256588.0, "compression.ratio": 0.87, "hidden_file_count": 1.0, "total_uncompressed": 296221.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 35.0, "rtlo_filename_count": 0.0, "format.regular_count": 17.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.06, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 17.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 2.0, "compression.method_counts.deflate": 15.0 } }, "v": { "file.stem": "902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191", "office.kind": "xlsx", "file.basename": "902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191.xlsm", "office.created": "2026-04-02T06:26:39Z", "office.creator": "u09253", "office.modified": "2026-06-03T12:02:54Z", "office.macros[0]": "xl/vbaProject.bin", "office.application": "Microsoft Excel", "office.features[0]": "macros", "archive.format.kind": "zip", "archive.members[0].path": "[Content_Types].xml", "archive.members[1].path": "_rels/.rels", "archive.members[2].path": "xl/_rels/workbook.xml.rels", "archive.members[3].path": "xl/workbook.xml", "archive.members[4].path": "xl/theme/theme1.xml", "archive.members[5].path": "xl/drawings/_rels/drawing1.xml.rels", "archive.members[6].path": "xl/worksheets/_rels/sheet1.xml.rels", "archive.members[7].path": "xl/worksheets/sheet2.xml", "archive.members[8].path": "xl/worksheets/sheet3.xml", "archive.members[9].path": "xl/worksheets/sheet1.xml", "office.last_modified_by": "oplup", "archive.members[0].crc32": 3846349113, "archive.members[10].path": "xl/styles.xml", "archive.members[11].path": "xl/drawings/drawing1.xml", "archive.members[12].path": "xl/vbaProject.bin", "archive.members[13].path": "xl/media/image1.png", "archive.members[14].path": "xl/media/image2.png", "archive.members[15].path": "docProps/app.xml", "archive.members[16].path": "docProps/core.xml", "archive.members[1].crc32": 590370229, "archive.members[2].crc32": 2520285084, "archive.members[3].crc32": 3468981561, "archive.members[4].crc32": 1839555323, "archive.members[5].crc32": 2623980630, "archive.members[6].crc32": 1017818901, "archive.members[7].crc32": 4180047502, "archive.members[8].crc32": 76560189, "archive.members[9].crc32": 347394859, "archive.timing.mtime_max": 315532800, "archive.timing.mtime_min": 315532800, "archive.members[10].crc32": 154998168, "archive.members[11].crc32": 3543924827, "archive.members[12].crc32": 779190665, "archive.members[13].crc32": 239273981, "archive.members[14].crc32": 1334448180, "archive.members[15].crc32": 1194065766, "archive.members[16].crc32": 2551374363, "archive.format.entry_types[0]": "regular", "archive.members[0].entry_type": "regular", "archive.members[0].mtime_unix": 315532800, "archive.members[0].size_bytes": 1529, "archive.members[1].entry_type": "regular", "archive.members[1].mtime_unix": 315532800, "archive.members[1].size_bytes": 588, "archive.members[2].entry_type": "regular", "archive.members[2].mtime_unix": 315532800, "archive.members[2].size_bytes": 961, "archive.members[3].entry_type": "regular", "archive.members[3].mtime_unix": 315532800, "archive.members[3].size_bytes": 738, "archive.members[4].entry_type": "regular", "archive.members[4].mtime_unix": 315532800, "archive.members[4].size_bytes": 7079, "archive.members[5].entry_type": "regular", "archive.members[5].mtime_unix": 315532800, "archive.members[5].size_bytes": 427, "archive.members[6].entry_type": "regular", "archive.members[6].mtime_unix": 315532800, "archive.members[6].size_bytes": 299, "archive.members[7].entry_type": "regular", "archive.members[7].mtime_unix": 315532800, "archive.members[7].size_bytes": 656, "archive.members[8].entry_type": "regular", "archive.members[8].mtime_unix": 315532800, "archive.members[8].size_bytes": 656, "archive.members[9].entry_type": "regular", "archive.members[9].mtime_unix": 315532800, "archive.members[9].size_bytes": 12291, "archive.compression.methods[0]": "deflate", "archive.compression.methods[1]": "stored", "archive.members[0].data_offset": 569, "archive.members[10].entry_type": "regular", "archive.members[10].mtime_unix": 315532800, "archive.members[10].size_bytes": 1377, "archive.members[11].entry_type": "regular", "archive.members[11].mtime_unix": 315532800, "archive.members[11].size_bytes": 2990, "archive.members[12].entry_type": "regular", "archive.members[12].mtime_unix": 315532800, "archive.members[12].size_bytes": 26624, "archive.members[13].entry_type": "regular", "archive.members[13].mtime_unix": 315532800, "archive.members[13].size_bytes": 378, "archive.members[14].entry_type": "regular", "archive.members[14].mtime_unix": 315532800, "archive.members[14].size_bytes": 238205, "archive.members[15].entry_type": "regular", "archive.members[15].mtime_unix": 315532800, "archive.members[15].size_bytes": 819, "archive.members[16].entry_type": "regular", "archive.members[16].mtime_unix": 315532800, "archive.members[16].size_bytes": 604, "archive.members[1].data_offset": 1542, "archive.members[2].data_offset": 2107, "archive.members[3].data_offset": 2432, "archive.members[4].data_offset": 2910, "archive.members[5].data_offset": 4659, "archive.members[6].data_offset": 4923, "archive.members[7].data_offset": 5166, "archive.members[8].data_offset": 5588, "archive.members[9].data_offset": 6009, "archive.members[10].data_offset": 7773, "archive.members[11].data_offset": 8453, "archive.members[12].data_offset": 9452, "archive.members[13].data_offset": 19307, "archive.members[14].data_offset": 19734, "archive.members[15].data_offset": 258249, "archive.members[16].data_offset": 258957, "archive.members[1].header_offset": 981, "archive.members[2].header_offset": 1787, "archive.members[3].header_offset": 2387, "archive.members[4].header_offset": 2861, "archive.members[5].header_offset": 4594, "archive.members[6].header_offset": 4858, "archive.members[7].header_offset": 5112, "archive.members[8].header_offset": 5534, "archive.members[9].header_offset": 5955, "archive.members[10].header_offset": 7730, "archive.members[11].header_offset": 8399, "archive.members[12].header_offset": 9405, "archive.members[13].header_offset": 19258, "archive.members[14].header_offset": 19685, "archive.members[15].header_offset": 257939, "archive.members[16].header_offset": 258646, "archive.members[0].compressed_size": 412, "archive.members[1].compressed_size": 245, "archive.members[2].compressed_size": 280, "archive.members[3].compressed_size": 429, "archive.members[4].compressed_size": 1684, "archive.members[5].compressed_size": 199, "archive.members[6].compressed_size": 189, "archive.members[7].compressed_size": 368, "archive.members[8].compressed_size": 367, "archive.members[9].compressed_size": 1721, "archive.members[10].compressed_size": 626, "archive.members[11].compressed_size": 952, "archive.members[12].compressed_size": 9806, "archive.members[13].compressed_size": 378, "archive.members[14].compressed_size": 238205, "archive.members[15].compressed_size": 397, "archive.members[16].compressed_size": 330, "archive.members[0].compression_method": "deflate", "archive.members[1].compression_method": "deflate", "archive.members[2].compression_method": "deflate", "archive.members[3].compression_method": "deflate", "archive.members[4].compression_method": "deflate", "archive.members[5].compression_method": "deflate", "archive.members[6].compression_method": "deflate", "archive.members[7].compression_method": "deflate", "archive.members[8].compression_method": "deflate", "archive.members[9].compression_method": "deflate", "archive.members[10].compression_method": "deflate", "archive.members[11].compression_method": "deflate", "archive.members[12].compression_method": "deflate", "archive.members[13].compression_method": "stored", "archive.members[14].compression_method": "stored", "archive.members[15].compression_method": "deflate", "archive.members[16].compression_method": "deflate", "archive.members[0].central_header_offset": 259287, "archive.members[1].central_header_offset": 259352, "archive.members[2].central_header_offset": 259409, "archive.members[3].central_header_offset": 259481, "archive.members[4].central_header_offset": 259542, "archive.members[5].central_header_offset": 259607, "archive.members[6].central_header_offset": 259688, "archive.members[7].central_header_offset": 259769, "archive.members[8].central_header_offset": 259839, "archive.members[9].central_header_offset": 259909, "archive.members[10].central_header_offset": 259979, "archive.members[11].central_header_offset": 260038, "archive.members[12].central_header_offset": 260108, "archive.members[13].central_header_offset": 260171, "archive.members[14].central_header_offset": 260236, "archive.members[15].central_header_offset": 260301, "archive.members[16].central_header_offset": 260363 }, "id": "xlsx" }, "id": 0, "sz": 260448, "ts": [ { "a": "T1059.005", "c": 1.0, "d": "OOXML document contains VBA macros (0 modules: )", "i": "metadata/format/macro::ooxml-has-vba", "l": 3 } ], "sha": "902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191", "path": "/data/samples/bad/foraged/_unknown/abuse.ch/malwarebazaar/902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191/902d1dee3000361a49b22d81c52a410a3521e06dcfd5b1422f46a5c2c3f80191.xlsm", "type": "xlsx" } ], "tv": "84adb" } }